added logging to custom authenticator to verify what's called when (or if at all)